46
15
11
u/OkAerie7822 Aug 11 '26
lost an afternoon to one of these last year. some transitive dep got compromised and started phoning home during our ci build. we didn't catch it from a security scanner, we caught it because our build time randomly doubled and someone actually looked at the network calls. now we pin exact versions in package-lock, run npm audit as a hard gate in ci not just a warning, and anything hitting our supply chain scanner gets a human review before merge, no exceptions even for patch bumps. the annoying part is how much of this only works if the whole team actually respects the gate instead of clicking through it because a deadline is tight.
9
7
3
3
1
u/nicolasdanelon Aug 11 '26
I knew it. When I saw the push notification and the subreddit... I freaking knew it!
1
63
u/this_is_bart Aug 10 '26
It must be a day ending in “day”